2025 CVEs (page 300)
Page 300 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5383 | Low | 2.4 | 2025-05-31 | A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Articl… |
CVE-2025-5381 | Low | 2.7 | 2025-05-31 | A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/download… |
CVE-2025-5380 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 up to 4d3f0ada0e71482c1e51fd5f5615e5a3d8bcbfbb. This… |
CVE-2025-5379 | Medium | 4.3 | 2025-05-31 | A vulnerability classified as critical was found in NuCom NC-WR744G 8.5.5 Build 20200530.307. This vulnerability affects unknown code of the component Console… |
CVE-2025-5378 | Medium | 4.3 | 2025-05-31 | A vulnerability classified as problematic has been found in Astun Technology iShare Maps 5.4.0. This affects an unknown part of the file mycouncil2.aspx. The m… |
CVE-2025-5377 | Medium | 4.3 | 2025-05-31 | A vulnerability was found in Astun Technology iShare Maps 5.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2025-5376 | High | 7.3 | 2025-05-31 | A vulnerability was found in SourceCodester Health Center Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerabilit… |
CVE-2025-4857 | High | 7.2 | 2025-05-31 | The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' parameter. This makes i… |
CVE-2025-4691 | Medium | 5.3 | 2025-05-31 | The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… |
CVE-2025-5375 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in PHPGurukul HPGurukul Online Birth Certificate System 2.0. It has been classified as critical. Affected is an unknown function of t… |
CVE-2025-5374 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in PHPGurukul Online Birth Certificate System 2.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2025-5373 | Medium | 6.3 | 2025-05-31 | A vulnerability has been found in PHPGurukul Online Birth Certificate System 2.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-5371 | High | 7.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in SourceCodester Health Center Patient Record Management System 1.0. Affected by this issue… |
CVE-2025-5290 | Medium | 6.4 | 2025-05-31 | The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up… |
CVE-2025-3813 | Medium | 6.4 | 2025-05-31 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions… |
CVE-2025-5292 | Medium | 6.4 | 2025-05-31 | The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable… |
CVE-2025-5285 | Medium | 6.4 | 2025-05-31 | The Product Subtitle for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmlTag’ parameter in all versions up to, and i… |
CVE-2025-4672 | High | 8.8 | 2025-05-31 | The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission_callback() functio… |
CVE-2025-4631 | Critical | 9.8 | 2025-05-31 | The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0… |
CVE-2025-4607 | Critical | 9.8 | 2025-05-31 | The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12 via the customer_r… |
CVE-2025-4595 | Medium | 6.4 | 2025-05-31 | The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog'… |
CVE-2025-4590 | Medium | 6.4 | 2025-05-31 | The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisycon_uitvaart' shortcode in all versions… |
CVE-2025-4103 | High | 8.8 | 2025-05-31 | The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function… |
CVE-2025-5370 | High | 7.3 | 2025-05-31 | A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. Affected by this vulnerability is an unknown functionality of the file /admin/f… |
CVE-2025-5369 | High | 7.3 | 2025-05-31 | A vulnerability classified as critical has been found in SourceCodester PHP Display Username After Login 1.0. Affected is an unknown function of the file /logi… |
CVE-2025-5368 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-5016 | Medium | 4.7 | 2025-05-31 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and includ… |
CVE-2025-5367 | High | 7.3 | 2025-05-31 | A vulnerability was found in PHPGurukul Online Shopping Portal Project 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-5365 | High | 7.3 | 2025-05-31 | A vulnerability was found in Campcodes Online Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file /adm… |
CVE-2025-5364 | High | 7.3 | 2025-05-30 | A vulnerability was found in Campcodes Online Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-5363 | High | 7.3 | 2025-05-30 | A vulnerability has been found in Campcodes Online Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2025-5362 | High | 7.3 | 2025-05-30 | A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /a… |
CVE-2025-5361 | High | 7.3 | 2025-05-30 | A vulnerability, which was classified as critical, has been found in Campcodes Online Hospital Management System 1.0. This issue affects some unknown processin… |
CVE-2025-5360 | High | 7.3 | 2025-05-30 | A vulnerability classified as critical was found in Campcodes Online Hospital Management System 1.0. This vulnerability affects unknown code of the file /book-… |
CVE-2025-48949 | Critical | 9.8 | 2025-05-30 | Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validatio… |
CVE-2025-48948 | Medium | 6.5 | 2025-05-30 | Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated… |
CVE-2025-48946 | Low | 3.7 | 2025-05-30 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the… |
CVE-2025-48882 | | 2025-05-30 | PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the sta… | |
CVE-2025-2503 | High | 7.1 | 2025-05-30 | An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an ele… |
CVE-2025-2502 | High | 7.8 | 2025-05-30 | An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. |
CVE-2025-2501 | High | 7.8 | 2025-05-30 | An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. |
CVE-2025-1479 | Medium | 5.3 | 2025-05-30 | An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to execute arbitrary cod… |
CVE-2025-5359 | High | 7.3 | 2025-05-30 | A vulnerability classified as critical has been found in Campcodes Online Hospital Management System 1.0. This affects an unknown part of the file /appointment… |
CVE-2025-48944 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/c… |
CVE-2025-48943 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes… |
CVE-2025-48942 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a… |
CVE-2025-48938 | Critical | 9.8 | 2025-05-30 | go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 wh… |
CVE-2025-48885 | | 2025-05-30 | application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary… | |
CVE-2025-48883 | | 2025-05-30 | Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly enc… | |
CVE-2025-5358 | High | 7.3 | 2025-05-30 | A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been rated as critical. Affected by this issue is some unknown funct… |
CVE-2025-5357 | High | 7.3 | 2025-05-30 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2025-5054 | Medium | 4.7 | 2025-05-30 | Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. … |
CVE-2025-48887 | Medium | 6.5 | 2025-05-30 | vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entr… |
CVE-2025-5356 | High | 7.3 | 2025-05-30 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component BYE Command Handler… |
CVE-2025-4992 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Relea… |
CVE-2025-4991 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEX… |
CVE-2025-4990 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE… |
CVE-2025-4989 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025… |
CVE-2025-4988 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x throu… |
CVE-2025-4986 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R… |
CVE-2025-4985 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXP… |
CVE-2025-4984 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to exec… |
CVE-2025-4983 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to… |
CVE-2025-3611 | Low | 3.1 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allow… |
CVE-2025-3230 | Medium | 5.4 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deact… |
CVE-2025-2571 | Medium | 4.2 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user account… |
CVE-2025-1792 | Low | 3.1 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member inf… |
CVE-2025-0602 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPE… |
CVE-2025-4598 | Medium | 4.7 | 2025-05-30 | A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access th… |
CVE-2025-48331 | High | 7.5 | 2025-05-30 | Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allow… |
CVE-2025-4433 | High | 8.8 | 2025-05-30 | Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and… |
CVE-2025-40909 | Medium | 5.9 | 2025-05-30 | Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the… |
CVE-2025-2500 | High | 7.4 | 2025-05-30 | A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized acce… |
CVE-2025-1484 | Medium | 6.5 | 2025-05-30 | A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confide… |
CVE-2025-5190 | High | 8.8 | 2025-05-30 | The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect authentication checki… |
CVE-2025-4944 | Medium | 6.4 | 2025-05-30 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widget… |
CVE-2025-4597 | Medium | 6.5 | 2025-05-30 | The Woo Slider Pro – Drag Drop Slider Builder For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili… |
CVE-2025-1763 | High | 8.7 | 2025-05-30 | An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific con… |
CVE-2025-5235 | Medium | 6.4 | 2025-05-30 | The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including… |
CVE-2025-5142 | Medium | 6.5 | 2025-05-30 | The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due t… |
CVE-2025-4636 | High | 7.8 | 2025-05-30 | Due to excessive privileges granted to the web user running the airpointer web platform, a malicious actor that gains control of the this user would be able to… |
CVE-2025-4635 | Medium | 6.6 | 2025-05-30 | A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code execution on the loc… |
CVE-2025-4634 | Medium | 4.1 | 2025-05-30 | The web portal on airpointer 2.4.107-2 was vulnerable local file inclusion. A malicious user with administrative privileges in the web portal would be able to… |
CVE-2025-4633 | Medium | 6.5 | 2025-05-30 | Default credentials were present in the web portal for Airpointer 2.4.107-2, allowing an unauthenticated malicious actor to log in via the web portal |
CVE-2025-48912 | Medium | 6.5 | 2025-05-30 | An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. T… |
CVE-2025-48334 | Medium | 6.5 | 2025-05-30 | Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro woo-slider-pro-drag-drop-slider-builder-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-5236 | Medium | 6.4 | 2025-05-30 | The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and inclu… |
CVE-2025-4431 | Medium | 4.3 | 2025-05-30 | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c… |
CVE-2025-4943 | Medium | 6.4 | 2025-05-30 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-lakit-element-link’ parameter in all ve… |
CVE-2025-48936 | High | 8.1 | 2025-05-30 | Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in the password reset… |
CVE-2025-48880 | Medium | 6.6 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, when an administrative account is a deleting a user, there is the the p… |
CVE-2025-48875 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, the system's incorrect validation of last_name and first_name during pr… |
CVE-2025-48865 | Critical | 9.1 | 2025-05-30 | Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (ex… |
CVE-2025-48492 | High | 8.8 | 2025-05-30 | GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject ar… |
CVE-2025-48489 | Medium | 4.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-48488 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file c… |
CVE-2025-48487 | Medium | 4.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when creating a translation of a phrase that appears in a flash-message… |
CVE-2025-48486 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the cross-site scripiting (XSS) vulnerability is caused by the lack of… |
CVE-2025-48485 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-47697 | High | 7.5 | 2025-05-30 | Client-side enforcement of server-side security issue exists in wivia 5 all versions. If exploited, an unauthenticated attacker may bypass authentication and o… |